Private

Woke up one morning to a Telegram message and a flood of emails on my personal account. Then I realized I was locked out of my work environments. It took a couple of days to get access back.

Crypto is a hard industry to live with. There are so many angles — the market cycles, the culture, the regulatory pressure — and the hacking is one of the biggest ones. The industry attracts serious adversaries precisely because of what it holds.

In those moments, trust is what pays the most. Not the trust you declare in a values document, but the trust you've built in your stack, in your habits, in the things you set up years ago and never needed to think about again. A slower audit follows the initial shock: my laptop, my repos, my keys. All the measures you put in place with the assumption that they'd never actually need to be tested.

The good news is that they held. No breach I could trace through me or through my machine. The measures I'd put in place, some of them years earlier and mostly out of habit rather than acute threat awareness, did what they were supposed to do. That's a strange relief, because you didn't know you were relying on them until the moment you checked.

The company's response was something else entirely.

Security theater is a specific genre of organizational behavior. You recognize it by a few tells: the measures feel proportionate to how they look from the outside rather than to actual risk; they create friction for engineers while leaving real attack surfaces untouched; they generate compliance checkboxes rather than protection. We got the full genre.

The Mac App Store was blocked. Homebrew was not. And this is only one of many, let me tell you.

The GPG hardware token policy was the one I couldn't let go of. The stated logic: you sign commits with a physical device, so stolen credentials alone can't sign without it. The actual practice: everyone kept the hardware plugged into their laptop at all times. Not occasionally — always, because you commit constantly and interrupting the flow to plug and unplug a small dongle is not something that survives contact with reality.

So if someone stole your laptop, they got the hardware too. The air gap you were promised was the USB port you left occupied.

I spent an afternoon looking for a better answer and found one: GPG signing via Touch ID on macOS. It works cleanly. The key is bound to the device's secure enclave, Touch ID is frictionless, and there's nothing physical to forget or leave plugged in. The policy demanded hardware; I ended up with something more secure by refusing to treat the policy as the end of the question. I'm using it right now, on every commit in this repo.

Worth noting: this only works on a MacBook. It's not a portable answer. But that's exactly the point — the right answer depends on your setup, your threat model, and your actual understanding of the tools in front of you. You don't arrive there by adopting a policy. You arrive there by reasoning.

Empty security imposed on engineers kills more than it protects. It kills the pace of work. It kills the instinct to question, because questioning gets reframed as resistance. And it accelerates a specific kind of isolation — the feeling that the institution's reflexes are pointed inward, at you, rather than outward at actual threats.

Security designed to make decision-makers feel better is not security. It's a tax on the people who already care — the ones who would have done the right thing anyway — while changing almost nothing about the actual risk profile. The engineers who would have clicked a phishing link before the hardware token policy will click one after. The engineers who wouldn't, won't.

Trust moves in both directions. The version that matters most isn't in your stack — it's what leadership builds with a team, and what gets reflected back. When that's working, engineers bring their best thinking forward, including the thinking that doesn't fit a ticket. When it isn't, you get the reverse: the impulse to keep things private, not because the policy says so, but because the environment stopped feeling like one worth contributing to.

One side effect I noticed in myself: I became less inclined to share things internally. The Paperworlds tools existed during that period, and I didn't bring them up. Partly because the atmosphere wasn't one that felt generous toward outside thinking. Partly because the environment had turned, slowly, into one where having a side project felt more like an exposure than a contribution. The repos went private by policy. Other things went private by feeling.

The title of this post is literal: the repositories had to go private during that stretch. I'm republishing them now, with a clean history and nothing I'm not comfortable having public. The incident was real. The threat was real. My audit passed.

What didn't pass was their audit process. The investigation stayed shallow — it asked whether a breach had occurred, not the deeper questions underneath: why the measures that held did hold, which ones held by luck rather than design, what the gaps look like that nobody checked. A security audit that doesn't ask those questions is just a checkbox looking for a pass.

That gap is what triggered something more useful in me: introspection as a practice. Looking inward, regularly, not just after an incident. I started applying the same lens to my AI sessions — going back through conversations, reviewing what I'd shared, what I'd assumed, what I'd left implicit. From that I built a recurring loop: not a one-off response, but a rhythm of checking what's drifting and what's holding. The incident gave me a framework I didn't have before. That might be the most useful thing that came out of it.

Good security is a craft. You don't become a Go developer by renaming your files .go. The people who build real security practices spend years studying the threat model before they touch the policy. I try to look around for best practices — and then question them, understand why they work and where they don't, before adopting anything. That's different from buying a paid product, pushing it to every laptop in the org, and going to sleep feeling secure. The product is not the practice.